Trivy

Official docs outline

Trivy overview
Targets, scanners, and the overall model of scanning artifacts with Trivy.
Supported targets and coverage
OS packages, language ecosystems, and what each scanner covers.
Vulnerability scanning
CVE detection, data sources, severity selection, and unfixed vulnerability handling.
Misconfiguration scanning
IaC checks for Terraform, Kubernetes, Dockerfile, and custom Rego policies.
Secret scanning
Detecting hardcoded credentials and writing custom secret rules.
License scanning
Detecting package licenses and classifying them by risk category.
Container image scanning
Scanning images from registries, daemons, and tar archives with layer analysis.
Filesystem and repository scanning
Scanning local directories, git repositories, and lock files in source trees.
Kubernetes scanning
Cluster and workload scanning for vulnerabilities, misconfiguration, and RBAC issues.
SBOM generation and scanning
Generating CycloneDX and SPDX SBOMs and scanning SBOMs for vulnerabilities.
Filtering results
Severity filters, .trivyignore, VEX, and ignoring unfixed findings.
Reporting and output formats
Table, JSON, SARIF, and template output and exit code behavior for CI.
Configuration file and CLI options
trivy.yaml settings that mirror CLI flags and caching and database options.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.